Sub-processors
Effective date: January 1, 2026
Creatornet engages the sub-processors below to operate the product. This page is the Sub-processor List referenced in the Data Processing Agreement (the "DPA"); changes to it follow the notice and objection mechanics in Section 8 of the DPA.
| Sub-processor | Purpose | Data | Applies to | Established in |
|---|---|---|---|---|
| Neon (a Databricks company) | Database hosting | The personal data the product stores | Product | United States |
| Vercel | Application hosting and background processing | Personal data processed by the application and its background jobs | Product and website | United States |
| Cloudflare | Edge network and file storage | Uploaded files and the traffic that passes through its network | Product | United States |
| Resend | Transactional email, contact form, marketing email | Recipient names, email addresses and message contents | Product and website | United States |
| Sentry | Error and performance monitoring, session replay on a sample of sessions and on errors, with text masked and media blocked | Error and performance events, device and browser information and masked session recordings | Product app only | United States |
| Upstash | Rate limiting | Request counters keyed by an IP address, organization or user identifier | Product and website | United States |
| Stripe | Subscription billing | Billing details for paid plans, including the card details entered with Stripe directly | Product | Ireland |
| Google Analytics | Web analytics. Stores or reads only after measurement consent | Website usage and device information | Website only | Ireland |
Transfers. Stripe and Google Analytics contract through Irish entities, so processing under those rows begins inside the EEA. Each routes personal data onward to its US affiliates under its own safeguards, such as the EU Standard Contractual Clauses or EU-US Data Privacy Framework certification. Every other sub-processor above is established in the United States, so the safeguard in Section 9 of the DPA applies to it directly. Each of those vendors publishes a data processing agreement incorporating the EU Standard Contractual Clauses. Several additionally hold EU-US Data Privacy Framework certification. Each of those agreements is in force between Creatornet and the vendor.
Third-party services, which are not sub-processors. Shopify, Meta and Google Sign-In are each their own controller rather than processing on Creatornet's instruction. Shopify and Meta are connected by the brand. Google Sign-In is chosen by an individual user at sign-in.